1458200 - CSP violation with source '; undefined' when using stripe.js v3

Status: RESOLVED MOVED

(WebExtensions :: Developer Outreach, defect, P3)

Description

[mike.maccana]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Build ID: 20180323154952

Steps to reproduce:

Visit a site with CSP enabled and stripe.js v3 / elements.

For example: https://stripe.github.io/elements-examples/



Actual results:

CSP errors with ';undefined' as the source. 

Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src"). Source: ;undefined.
controller-0eca176b6760834c948cb1a36c2b717d.html:1

Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src"). Source: ;undefined.
elements-inner-card-8aa1cabc2437b05357092b80c566edd0.html:1



Expected results:

Either no errors, or CSP errors with a source.

Comment 1

[mike.maccana]

IMPORTANT UPDATE: this error only occurs when using the LastPass extension. It may be that LastPass is doing something bad, but a source of '; undefined' isn't logical and doesn't help site owners work out what the CSP violation is.

Comment 2

[Cosmin Muntean [:cmuntean], Ecosystem QA]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Firefox 61.0a1, Build ID: 20180503220110

I have managed to reproduce this issue on latest Nightly (61.0a1) build and latest Firefox (59.0.3) releas with LastPass extension installed.
Probably this should be fixed on the LastPass side, but I will assign a component to this issue in order to involve the developers team and get an opinion on this.

Comment 3

[Mike Taylor [:miketaylr]]

Anatoly, is this a known issue?

Comment 4

[Anatoly]

(In reply to Mike Taylor [:miketaylr] from comment #3)
> Anatoly, is this a known issue?

Sorry, I don't work on the desktop extensions, but will pass this along to the right team.

Comment 5

[Mike Taylor [:miketaylr]]

Thanks!

Comment 6

[mike.maccana]

Just wondering, since I've written a few Chrome extensions and I understand the API is similar here: shouldn't this also be on Firefox itself, since even if CSP violations occur, it shouldn't be possible for CSP violations to have a source of '; undefined'?

Comment 7

[Gabor Magyari]

Hi! I'm from the LastPass dev team, currently investigating this issue. I can confirm that the CSP errors occur when the LastPass extension is installed, but it is really hard to track down the issue without getting the source of the violation.
Also, the js files are loaded correctly despite the error states CSP blocked it.

Can somebody from Firefox take a look what is generating these error messages exactly?

Comment 8

[Mike Taylor [:miketaylr]]

Christoph, is there a way Gabor can enable a debug log or something to track down this CSP error? Thanks.

Comment 9

[Christoph Kerschbaumer [:ckerschb]]

It's quite unfortunate that we only log ';undefined' which obviously isn't very helpful.

To debug this one could set an environment variable like:
> export MOZ_LOG=CSPContext:5,CSPUtils:5
which logs CSP internals, but for that specific issue I don't think our logging will produce some relevant output.

The error 'blocked the loading of a resource at self ("script-src")' indicates it's an inline script violation. FWIW, all the CSP code lives in dom/security and all console logging happens here [1]. Probably it's best to work backwards, e.g. add a MOZ_ASSERT() within [1]. Look at the stacktrace, see where the call comes from (most likely from within the ScriptLoader). At the callsite you should have more context available, e.g. print the including context, the entire script or something there like.

Once we know that, the extension could fix the CSP problem and we could improve our console logging.

Sorry, this is all the information I can offer at the moment!

[1] https://dxr.mozilla.org/mozilla-central/source/dom/security/nsCSPUtils.cpp#126

Comment 10

[Mike Taylor [:miketaylr]]

That's super helpful, thanks Christoph. 

Hi Gabor, please see comment #9, thanks!

Comment 11

[Gabor Magyari]

This is the relevant part of the CSP internals log:

[16008:Main Thread]: D/CSPUtils nsCSPPolicy::permits, aUri: https://js.stripe.com/v3/fingerprinted/js/controller-fbf06e5045244423fb4833c7e87a9c32.js, aDir: 2, aSpecific: false
[16008:Main Thread]: D/CSPUtils nsCSPDirective::permits, aUri: https://js.stripe.com/v3/fingerprinted/js/controller-fbf06e5045244423fb4833c7e87a9c32.js
[16008:Main Thread]: D/CSPUtils nsCSPHostSrc::permits, aUri: https://js.stripe.com/v3/fingerprinted/js/controller-fbf06e5045244423fb4833c7e87a9c32.js
[16008:Main Thread]: D/CSPContext nsCSPContext::ShouldLoad, decision: load, aContentLocation: https://js.stripe.com/v3/fingerprinted/js/controller-fbf06e5045244423fb4833c7e87a9c32.js
[16008:Main Thread]: D/CSPUtils nsCSPPolicy::allows, aKeyWord: 'unsafe-inline', a HashOrNonce: 
[16008:Main Thread]: D/CSPUtils nsCSPDirective::allows, aKeyWord: 'unsafe-inline', a HashOrNonce: 
[16008:Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: 'unsafe-inline', a HashOrNonce: 
[16008:Main Thread]: D/CSPUtils nsCSPPolicy::allows, aKeyWord: 'nonce-, a HashOrNonce: 
[16008:Main Thread]: D/CSPUtils nsCSPDirective::allows, aKeyWord: 'nonce-, a HashOrNonce: 
[16008:Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: 'nonce-, a HashOrNonce: 
[16008:Main Thread]: D/CSPUtils nsCSPPolicy::allows, aKeyWord: error: invalid keyword in CSP_EnumToUTF8Keyword, a HashOrNonce: ;undefined
[16008:Main Thread]: D/CSPUtils nsCSPDirective::allows, aKeyWord: error: invalid keyword in CSP_EnumToUTF8Keyword, a HashOrNonce: ;undefined
[16008:Main Thread]: D/CSPUtils nsCSPBaseSrc::allows, aKeyWord: hash, a HashOrNonce: ;undefined

Comment 12

[Gabor Magyari]

Ok, I've found the issue. The source is ";undefined" because the extension is actually adding this text as an inline script and it comes from a build issue.

It is on us and the fix is on the way. Thanks for the help from everyone.

Comment 13

[mike.maccana]

Shouldn't Firefox still come back with a proper source (something like 'extension-inline' or similar) when a CSP violation is caused by an line script on the page? Should extensions cause CSP violations at all?

Comment 14

[Mike Taylor [:miketaylr]]

(In reply to Gabor Magyari from comment #12)
> Ok, I've found the issue. The source is ";undefined" because the extension
> is actually adding this text as an inline script and it comes from a build
> issue.
> 
> It is on us and the fix is on the way. Thanks for the help from everyone.

Nice! Thanks Gabor.(In reply to mike.maccana from comment #13)
> Shouldn't Firefox still come back with a proper source (something like
> 'extension-inline' or similar) when a CSP violation is caused by an line
> script on the page? Should extensions cause CSP violations at all?

Yes, extensions should cause CSP violations, if they're violating a sites CSP policy. As for proper source, that's probably worth a new bug if it's not covered by Bug 1242016.

Comment 15

[Benjamin Melançon]

As this can silently block very important interactions (payments and donations!), are there any mitigations the developers of web sites can make in the meantime?

Comment 16

[David Durst [:ddurst]]

As this is already blocking 1242016 months ago (per #a713249_363267), I'm going to just P3 this to get it off triage radar, since it will likely be handled elsewhere.

Comment 18

[Luca Greco [:rpl] [:luca] [:lgreco]]

Closing as moved, per comment 12 the devs have been notified and followed up with fixes on the extension side.